Certified Chief Information Security Officer Certification

Certified Chief Information Security Officer Certification

Domain 1: Governance and Risk Management 

Module 1: Define, Implement, Manage, and Maintain an Information Security Governance Program 

• Form of Business Organisation 

• Industry 

• Organisational Maturity 
   

Module 2: Information Security Drivers 
 

Module 3: Establishing an Information Security Management Structure 

• Organisational Structure 

• Where does the CISO fit within the Organisational Structure 

• The Executive CISO 

• Nonexecutive CISO 
   

Module 4: Laws/Regulations/Standards as Drivers of Organisational Policy/Standards/Procedures 

Module 5: Managing an Enterprise Information Security Compliance Program 

• Security Policy 

• Necessity of a Security Policy 

• Security Policy Challenges 

• Policy Content 

• Types of Policies 

• Policy Implementation 

• Reporting Structure 

• Standards and Best Practices 

• Leadership and Ethics 

• EC-Council Code of Ethics 
   

Module 6: Introduction to Risk Management 

• Organisational Structure 

• Where does the CISO fit within the Organisational Structure 

• The Executive CISO 

• Nonexecutive CISO 
   

Domain 2: Information Security Controls, Compliance, and Audit Management 
 

Module 7: Information Security Controls 

• Identifying the Organisation’s Information Security Needs 

• Identifying the Optimum Information Security Framework 

• Designing Security Controls 

• Control Lifecycle Management 

• Control Classification 

• Control Selection and Implementation 

• Control Catalogue 

• Control Maturity 

• Monitoring Security Controls 

• Remediating Control Deficiencies 

• Maintaining Security Controls 

• Reporting Controls 

• Information Security Service Catalogue 
   

Module 8: Compliance Management 

• Acts, Laws, and Statutes 

• FISMA 

• Regulations 

• GDPR 

• Standards 

• ASD—Information Security Manual 

• Basel III 

• FFIEC 

• ISO 00 Family of Standards 

• NERC-CIP 

• PCI DSS 

• NIST Special Publications 

• Statement on Standards for Attestation Engagements No. 16 (SSAE 16)
   

Module 9: Guidelines, Good and Best Practices 

• CIS 

• OWASP 
   

Module 10: Audit Management 

• Audit Expectations and Outcomes 

• IS Audit Practices 

• ISO/IEC Audit Guidance 

• Internal versus External Audits 

• Partnering with the Audit Organisation 

• Audit Process 

• General Audit Standards 

• Compliance-Based Audits 

• Risk-Based Audits 

• Managing and Protecting Audit Documentation 

• Performing an Audit 

• Evaluating Audit Results and Report 

• Remediating Audit Findings 

• Leverage GRC Software to Support Audits 
   

Domain 3: Security Program Management & Operations 
 

Module 11: Program Management 

• Defining a Security Charter, Objectives, Requirements, Stakeholders, and Strategies 

• Security Program Charter 

• Security Program Objectives 

• Security Program Requirements 

• Security Program Stakeholders 

• Security Program Strategy Development 

• Executing an Information Security Program 

• Defining and Developing, Managing and Monitoring the Information Security Program 

• Defining an Information Security Program Budget 

• Developing an Information Security Program Budget 

• Managing an Information Security Program Budget 

• Monitoring an Information Security Program Budget 

• Defining and Developing Information Security Program Staffing Requirements 

• Managing the People of a Security Program 

• Resolving Personnel and Teamwork Issues 

• Managing Training and Certification of Security Team Members 

• Clearly Defined Career Path 

• Designing and Implementing a User Awareness Program 

• Managing the Architecture and Roadmap of the Security Program 

• Information Security Program Architecture 

• Information Security Program Roadmap 

• Program Management and Governance 

• Understanding Project Management Practices 

• Identifying and Managing Project Stakeholders 

• Measuring the Effectives of Projects 

• Business Continuity Management (BCM) and Disaster Recovery Planning (DRP) 

• Data Backup and Recovery 

• Backup Strategy 

• ISO BCM Standards 

• Business Continuity Management (BCM) 

• Disaster Recovery Planning (DRP) 

• Continuity of Security Operations 

• Integrating the Confidentiality, Integrity and Availability (CIA) Model 

• BCM Plan Testing 

• DRP Testing 

• Contingency Planning, Operations, and Testing Programs to Mitigate Risk and Meet Service Level Agreements (SLAs) 

• Computer Incident Response 

• Incident Response Tools 

• Incident Response Management 

• Incident Response Communications 

• Post-Incident Analysis 

• Testing Incident Response Procedures 

• Digital Forensics 

• Crisis Management 

• Digital Forensics Life Cycle 
   

Module 12: Operations Management 

• Establishing and Operating a Security Operations (SecOps) Capability 

• Security Monitoring and Security Information and Event Management (SIEM) 

• Event Management 

• Incident Response Model 

• Developing Specific Incident Response Scenarios 

• Threat Management 

• Threat Intelligence 

• Information Sharing and Analysis Centres (ISAC) 

• Vulnerability Management 

• Vulnerability Assessments 

• Vulnerability Management in Practice 

• Penetration Testing 

• Security Testing Teams 

• Remediation 

• Threat Hunting 
   

Module 13: Summary 
 

Domain 4: Information Security Core Competencies 
 

Module 14: Access Control 

• Authentication, Authorisation, and Auditing 

• Authentication 

• Authorisation 

• Auditing 

• User Access Control Restrictions 

• User Access Behaviour Management 

• Types of Access Control Models 

• Designing an Access Control Plan 

• Access Administration 
   

Module 15: Physical Security 

• Designing, Implementing, and Managing Physical Security Program 

• Physical Risk Assessment 

• Physical Location Considerations 

• Obstacles and Prevention 

• Secure Facility Design 

• Security Operations Centre 

• Sensitive Compartmented Information Facility 

• Digital Forensics Lab 

• Datacentre 

• Preparing for Physical Security Audits
   

Module 16: Network Security 

• Network Security Assessments and Planning 

• Network Security Architecture Challenges 

• Network Security Design 

• Network Standards, Protocols, and Controls 

• Network Security Standards 

• Protocols
   

Module 17: Certified Chief 

• Network Security Controls 

• Wireless (Wi-Fi) Security 

• Wireless Risks 

• Wireless Controls 

• Voice over IP Security 
   

Module 18: Endpoint Protection 

• Endpoint Threats 

• Endpoint Vulnerabilities 

• End User Security Awareness 

• Endpoint Device Hardening 

• Endpoint Device Logging 

• Mobile Device Security 

• Mobile Device Risks 

• Mobile Device Security Controls 

• Internet of Things Security (IoT) 

• Protecting IoT Devices 
   

Module 19: Application Security 

• Secure SDLC Model 

• Separation of Development, Test, and Production Environments 

• Application Security Testing Approaches 

• DevSecOps 

• Waterfall Methodology and Security 

• Agile Methodology and Security 

• Other Application Development Approaches 

• Application Hardening 

• Application Security Technologies 

• Version Control and Patch Management 

• Database Security 

• Database Hardening 

• Secure Coding Practices 
   

Module 20: Encryption Technologies 

• Encryption and Decryption 

• Cryptosystems 

• Blockchain 

• Digital Signatures and Certificates 

• PKI 

• Key Management 

• Hashing 

• Encryption Algorithms 

• Encryption Strategy Development 

• Determining Critical Data Location and Type 

• Deciding What to Encrypt 

• Determining Encryption Requirements 

• Selecting, Integrating, and Managing Encryption Technologies 
   

Module 21: Virtualisation Security 

• Virtualisation Overview 

• Virtualisation Risks 

• Virtualisation Security Concerns 

• Virtualisation Security Controls 

• Virtualisation Security Reference Model 
   

Module 22: Cloud Computing Security 

• Overview of Cloud Computing 

• Security and Resiliency Cloud Services 

• Cloud Security Concerns 

• Cloud Security Controls 

• Cloud Computing Protection Considerations 
   

Module 23: Transformative Technologies 

• Artificial Intelligence 

• Augmented Reality 

• Autonomous SOC 

• Dynamic Deception 

• Software-Defined Cybersecurity 
   

Domain 5: Strategic Planning, Finance, Procurement and Vendor Management 

Module 24: Strategic Planning 

• Understanding the Organisation 

• Understanding the Business Structure 

• Determining and Aligning Business and Information Security Goals 

• Identifying Key Sponsors, Stakeholders, and Influencers 

• Understanding Organisational Financials 

• Creating an Information Security Strategic Plan 

• Strategic Planning Basics 

• Alignment to Organisational Strategy and Goals 

• Defining Tactical Short, Medium, and Long-Term Information Security Goals 

• Information Security Strategy Communication 

• Creating a Culture of Security 
   

Module 25: Designing, Developing, and Maintaining an Enterprise Information Security Program 

• Ensuring a Sound Program Foundation 

• Architectural Views 

• Creating Measurements and Metrics 

• Balanced Scorecard 

• Continuous Monitoring and Reporting Outcomes 

• Continuous Improvement 

• Information Technology Infrastructure Library (ITIL) Continual Service Improvement (CSI) 
   

Module 26: Understanding the Enterprise Architecture (EA) 

• EA Types 

• The Zachman Framework 

• The Open Group Architecture Framework (TOGAF) 

• Sherwood Applied Business Security Architecture (SABSA) 

• Federal Enterprise Architecture Framework (FEAF) 
   

Module 27: Finance 

• Understanding Security Program Funding 

• Analysing, Forecasting, and Developing a Security Budget 

• Resource Requirements 

• Define Financial Metrics 

• Technology Refresh 

• New Project Funding 

• Contingency Funding 

• Managing the information Security Budget 

• Obtain Financial Resources 

• Allocate Financial Resources 

• Monitor and Oversight of Information Security Budget 

• Report Metrics to Sponsors and Stakeholders 

• Balancing the Information Security Budget 
   

Module 28: Procurement 

• Procurement Program Terms and Concepts 

• Statement of Objectives (SOO) 

• Statement of Work (SOW) 

• Total Cost of Ownership (TCO) 

• Request for Information (RFI) 

• Request for Proposal (RFP) 

• Master Service Agreement (MSA) 

• Service Level Agreement (SLA) 

• Terms and Conditions (T&C) 

• Understanding the Organisation’s Procurement Program 

• Internal Policies, Processes, and Requirements 

• External or Regulatory Requirements 

• Local Versus Global Requirements 

• Procurement Risk Management 

• Standard Contract Language 
   

Module 29: Vendor Management 

• Understanding the Organisation’s Acquisition Policies and Procedures 

• Procurement Life cycle 

• Applying Cost-Benefit Analysis (CBA) During the Procurement Process 

• Vendor Management Policies 

• Contract Administration Policies 

• Service and Contract Delivery Metrics 

• Contract Delivery Reporting 

• Change Requests 

• Contract Renewal 

• Contract Closure 

• Delivery Assurance 

• Validation of Meeting Contractual Requirements 

• Formal Delivery Audits 

• Periodic Random Delivery Audits 

• Third-Party Attestation Services (TPRM)